en-US/about_EndpointForge.help.txt

TOPIC
    about_EndpointForge
 
SHORT DESCRIPTION
    Beginner-friendly Windows computer checkups, safe fix previews, comparisons, and reports.
 
LONG DESCRIPTION
    A checklist is simply a list of things expected to be true, such as Windows settings,
    required files, recent events, or an available network service. Selecting, viewing,
    creating, or validating one does not run it or change Windows. EndpointForge helps a
    person answer four practical questions about a Windows computer:
 
        1. Does this computer look healthy?
        2. Do important settings and everyday checks match the selected checklist?
        3. Which problems can EndpointForge safely preview and fix?
        4. What changed between an earlier check and a later check?
 
    The guided menu uses everyday language and labels whether each choice reads
    information, creates a file, or can change a Windows setting. Normal checks do not
    change Windows. A supported fix is never applied until it has been selected,
    previewed, and explicitly approved.
 
    EndpointForge works in Windows PowerShell 5.1 and PowerShell 7 on supported Windows
    client and server versions. Its commands can also be used in approved scripts,
    scheduled tasks, Intune, Configuration Manager, RMM systems, and PowerShell remote
    sessions.
 
FIRST RUN
    Install EndpointForge for the current Windows user:
 
        Install-Module -Name EndpointForge -Scope CurrentUser
 
    Import it and open the guided menu:
 
        Import-Module EndpointForge
        Show-EFMenu
 
    Start with menu option 1, Check this computer now. The check reads computer health,
    restart status, security information, and selected Windows settings. It does not
    change Windows.
 
    Some protected information and all approved fixes require a PowerShell window opened
    with Run as administrator. A standard-user window can still run normal checks and
    no-change previews.
 
EVERYDAY TERMS
    EndpointForge uses plain wording in its menu. PowerShell commands retain several
    technical names so existing scripts remain compatible.
 
    Checklist
        A list of things expected to be true, such as settings, files, recent events, or
        an available network service. Selecting a checklist does not run or apply it.
 
    Baseline
        The script-facing name for a checklist. A parameter named Baseline asks which
        checklist to use.
 
    Checklist item
        One thing to check, such as a setting, file, event, or network connection.
 
    Control
        The script-facing name for a checklist item. ControlId is the item's stable name
        for scripts, such as EF-FW-DOMAIN.
 
    Matches
        EndpointForge read the current value and it equals the checklist value.
 
    Compliance
        The technical name for comparing current settings with a checklist. Compliant
        means a setting matches. NonCompliant means it was read successfully but does not
        match. Compliance checking by itself never changes Windows.
 
    Supported fix
        A narrow setting change EndpointForge knows how to preview, apply, and check
        again. Many findings are intentionally report-only.
 
    Remediation
        The script-facing name for applying a supported fix. A remediation plan only
        explains possible actions; it does not change Windows.
 
    Preview or WhatIf
        A no-change rehearsal. PowerShell calls this WhatIf and uses the -WhatIf switch.
        A preview shows what a supported fix would try to change without making the
        change.
 
    Could not check
        Windows did not provide a definite answer. This is not treated as passing,
        matching, or fixed.
 
    Administrator or elevated session
        A PowerShell window opened with Run as administrator. Windows requires this extra
        permission for protected information and setting changes.
 
    Endpoint
        An IT term for a managed computer.
 
    Receipt
        A record of an attempted fix, including the value before, the value afterward,
        the result, safety notes, and recovery guidance.
 
    HTML report
        A self-contained web-page file intended for a person to read in a browser.
 
    JSON report
        A structured data file intended for scripts and support tools. It preserves more
        nested technical detail than a human-readable report.
 
GOAL-BASED MENU
    Show-EFMenu organizes work by the result a person wants:
 
        1. Check this computer now
           Reads information and does not change Windows.
 
        2. Understand the latest results
           Shows a simple summary, detailed explanations, earlier-versus-later changes,
           and computer details.
 
        3. Fix selected problems safely
           Builds a plan, lets the user select supported fixes, performs a mandatory
           preview, and asks for final approval before any setting change.
 
        4. Save reports or compare checks
           Creates a readable HTML report, a detailed JSON report, or a comparison when
           the user chooses that action.
 
        5. Check other computers
           Runs non-changing checks on computers already prepared for approved PowerShell
           remote management. It never runs remote fixes. TCP checklist items require
           explicit approval and can make observable connections from every computer.
 
        6. Change what EndpointForge checks
           Selects, loads, validates, or creates checklist files. Selecting a checklist
           never applies its settings.
 
        A. Tools for IT scripts and troubleshooting
        H. Help that explains every choice
        Q. Exit
 
    The menu keeps results only for the current menu session unless a report is saved.
    Changing the checklist clears earlier menu results so results from different
    checklists are not mistaken for one another.
 
READINESS
    Readiness is a no-change preflight. It explains what the current PowerShell window is
    prepared to check or fix:
 
        Get-EFEndpointReadiness
 
    It checks whether the platform is Windows, whether the checklist is valid, whether
    the current window has Administrator permission, whether it is a remote session, and
    whether Windows provides the commands required by each checklist item. It does not
    read the actual policy values and does not change anything.
 
    A readiness result with limits does not mean the whole check failed. It means some
    protected or unavailable items may be reported as Could not check or report-only.
    Review the result details before deciding whether to reopen PowerShell with Run as
    administrator.
 
RUN A COMPUTER CHECK
    The recommended read-only script command is:
 
        $check = Get-EFEndpointSummary -NoProgress
        $check | Show-EFEndpointSummary
 
    Show every finding and its explanation:
 
        $check | Show-EFEndpointSummary -Detailed
 
    Get-EFEndpointSummary returns structured data for scripts. Show-EFEndpointSummary is
    the display for people. Scripts should read object properties instead of parsing the
    displayed text.
 
    Include installed software only when it is needed because collection takes longer
    and the resulting report contains more private device information:
 
        $check = Get-EFEndpointSummary -IncludeSoftware -NoProgress
 
UNDERSTAND RESULTS
    The terminal translates script statuses into these descriptions:
 
        Looks good
            The health and checklist items that were read do not need attention.
 
        Needs attention
            A warning or checklist difference was found.
 
        Urgent attention
            A critical health or security difference was found.
 
        Could not check everything
            One or more answers were unavailable, protected, or failed to load.
 
        Not used on this computer
            The feature is absent or does not apply to this Windows computer.
 
    Unknown information is never silently counted as healthy. Review WhyItMatters,
    HowChecked, WhatWouldChange, ManualAction, SafetyNotes, and RecoveryGuidance when
    those explanation fields are present.
 
SAFE FIX FLOW
    Menu option 3 is the safest interactive path. It always follows this order:
 
        1. Run or reuse a read-only computer check.
        2. Explain each item that needs attention.
        3. Separate supported fixes from manual review and unavailable information.
        4. Let the user select specific supported fixes.
        5. Run a fresh WhatIf preview that cannot change Windows.
        6. Stop if the preview is incomplete or reports a failure.
        7. Require a PowerShell window opened with Run as administrator.
        8. Show the computer, selected items, current values, expected values, and
           possible restart impact.
        9. Require the user to type APPLY exactly.
       10. Apply only the selected items and check their new values.
       11. Run a fresh computer check and show a before-and-after comparison.
 
    A standard-user window may complete the preview. It then explains how to reopen
    PowerShell as Administrator. EndpointForge does not restart itself with higher
    permission and does not bypass Windows security prompts.
 
    The equivalent script workflow is:
 
        $plan = Get-EFRemediationPlan -NoProgress
        $approvedIds = $plan.Steps |
            Where-Object CanFixAutomatically |
            Select-Object -ExpandProperty ControlId
 
        Invoke-EFEndpointRemediation -ControlId $approvedIds -WhatIf -NoProgress
 
        # Run only after approval, from an Administrator window.
        $result = Invoke-EFEndpointRemediation `
            -ControlId $approvedIds -Confirm:$false -NoProgress
 
        $verification = Get-EFComplianceReport -ControlId $approvedIds -NoProgress
 
    The low-level apply command uses normal PowerShell confirmation behavior. Scripts are
    responsible for approval, selection, testing, and organizational change control. The
    menu adds the extra exact APPLY acknowledgement.
 
    The built-in EnterpriseRecommended checklist can offer narrow supported fixes for
    Windows Firewall profiles, User Account Control, Microsoft Defender real-time
    protection when Defender manages it, the SMB 1.0 optional feature, and the Windows
    Update service start setting.
 
    BitLocker, Secure Boot, and Trusted Platform Module readiness are report-only.
    EndpointForge will not change them automatically.
 
RECEIPTS, RESTARTS, AND RECOVERY
    Each preview or applied fix returns a receipt. It records the before value, desired
    value, after value, whether a change was applied, what changed, and available safety
    and recovery guidance.
 
    EndpointForge never restarts Windows automatically. A receipt may say that an
    approved restart should be scheduled through the organization's normal process.
 
    EndpointForge does not promise automatic rollback. Restoring a saved value is not
    always safe because Group Policy, mobile-device management, Defender tamper
    protection, a service dependency, another security product, or a later Windows
    change may own the setting. Use the receipt's before value and RecoveryGuidance with
    an approved recovery process. Identify and use the owning management system when a
    centrally managed setting does not stay changed.
 
SAVE REPORTS
    Save a human-readable HTML report:
 
        Get-EFEndpointSummary -NoProgress |
            Export-EFEndpointReport -Path .\computer-check.html
 
    The HTML file is self-contained. It uses embedded styling, loads no JavaScript,
    fonts, or internet content, and encodes report values before placing them in the page.
 
    Save detailed JSON data for scripts or support tools:
 
        Get-EFEndpointSummary -NoProgress |
            Export-EFEndpointReport -Path .\computer-check.json
 
    CSV and CLIXML are also supported. The file extension selects the format. Existing
    files require -Force. Export supports -WhatIf so a script can preview the file action.
 
    Reports may contain computer names, hardware, network addresses, installed software,
    security posture, checklist details, and change evidence. Store reports only in an
    approved location with least-privilege permissions and appropriate retention.
 
COMPARE EARLIER AND LATER CHECKS
    Compare two saved JSON reports:
 
        $difference = Compare-EFEndpointSummary `
            -Before .\before.json -After .\after.json
        $difference
 
    Or compare two in-memory results:
 
        $before = Get-EFEndpointSummary -NoProgress
        # Approved maintenance happens here.
        $after = Get-EFEndpointSummary -NoProgress
        Compare-EFEndpointSummary -Before $before -After $after
 
    The comparison separates definite improvements, newly detected problems, unchanged
    items, newly available information, and items the later check could not read. A
    missing or incomplete later result is never described as fixed.
 
    By default, checks with different computer names are rejected. Use
    -AllowDifferentComputer only for an intentional side-by-side view, not to measure
    progress. A warning is also returned when the checklist name or version changed,
    because that is not a like-for-like comparison.
 
CHECK OTHER COMPUTERS WITHOUT CHANGING THEM
    Get-EFFleetSummary checks several Windows computers and returns successful results and
    connection failures in one object:
 
        $fleet = Get-EFFleetSummary -ComputerName PC-101,PC-102
        $fleet.Results
        $fleet.Failures
 
    This command never changes Windows settings or runs fixes. A checklist containing TCP
    items can still make the observable connection attempts explained below. Before it can
    work, every target computer must
    already:
 
        - allow PowerShell remoting under the organization's policy;
        - have EndpointForge 0.5.0 or later installed; and
        - allow the connecting account to run the check.
 
    EndpointForge does not install itself remotely, enable WinRM, change TrustedHosts,
    adjust firewall rules, or run remote fixes. It reports connection failures alongside
    successful results.
 
    A checklist with TcpPort items is read-only, but every remote computer briefly tries
    the named connection. The destination, firewall, or network monitoring tools may
    record each attempt. Get-EFFleetSummary blocks these items until the checklist has
    been reviewed and -AllowNetworkChecks is supplied:
 
        Get-EFFleetSummary `
            -ComputerName PC-101,PC-102 `
            -Baseline .\checklists\Contoso.EverydayChecks.json `
            -AllowNetworkChecks
 
    No application data is sent. A successful connection does not test HTTPS, sign-in,
    or whether the application itself is healthy.
 
    Use a credential only when the approved environment requires one:
 
        $credential = Get-Credential
        Get-EFFleetSummary `
            -ComputerName (Get-Content .\computers.txt) `
            -Credential $credential
 
    The credential is used for the remote connection and is not stored in the returned
    fleet report. Check an affected computer directly before approving any fix.
 
CHECKLISTS FOR AN ORGANIZATION
    Load the built-in checklist:
 
        $checklist = Get-EFBaseline -Name EnterpriseRecommended
 
    Create an editable starter file and validate it:
 
        New-EFBaseline `
            -Name Contoso.Workstation `
            -Template Starter `
            -Path .\checklists\Contoso.Workstation.json
 
        Test-EFBaseline `
            -Path .\checklists\Contoso.Workstation.json `
            -PassThru
 
    Create editable examples for a required file, text near the end of a log, recent
    Windows events, and one TCP connection:
 
        New-EFBaseline `
            -Name Contoso.EverydayChecks `
            -Template EverydayChecks `
            -Path .\checklists\Contoso.EverydayChecks.json
 
    Replace every sample file path, search text, event source and ID, and host name before
    running the new checklist. The installed examples\EverydayChecks.json file explains
    each property in plain language.
 
    Use the validated file for a read-only check:
 
        Get-EFEndpointSummary `
            -Baseline .\checklists\Contoso.Workstation.json `
            -NoProgress
 
    New-EFBaseline creates a starting file. It is not a substitute for organizational
    review and testing. Template accepts Starter, EnterpriseRecommended, AuditOnly, or
    EverydayChecks. The command supports -WhatIf and will not replace an existing file
    unless -Force is used.
 
    Custom checklist files are privileged configuration input. Review them, store them in
    source control, and protect them from untrusted writes before an Administrator
    process uses them. Validate after every edit and before every deployment.
 
    EndpointForge 0.5.0 supports Registry, Service, FirewallProfile, Defender,
    WindowsOptionalFeature, BitLocker, SecureBoot, Tpm, FileExists, FileContainsText,
    WindowsEvent, and TcpPort checklist items. BitLocker, SecureBoot, Tpm, FileExists,
    FileContainsText, WindowsEvent, and TcpPort items are report-only. They report an
    answer and manual guidance, but EndpointForge never fixes them automatically.
 
    The four everyday types use a Boolean DesiredValue. True means the named file or text
    should be present, enough events should exist, or the connection should succeed.
    False means it should not. Set Remediable to false and RequiresReboot to false.
 
    FileExists
        Path is required. It checks one exact file on a local Windows drive. Environment
        variables such as %ProgramData% are allowed. Relative paths, network shares,
        mapped network drives, wildcards, alternate data streams, and paths through links
        are rejected. A folder does not count as a file.
 
    FileContainsText
        Path and Text are required, and the same safe local-path rules as FileExists
        apply. Text is an ordinary literal string, not a wildcard or regular expression.
        TailLines defaults to 2,000 and accepts 1 through 10,000. CaseSensitive defaults
        to false. Encoding defaults to Utf8 and also accepts Unicode,
        BigEndianUnicode, or Ascii.
 
        Only the selected tail is read. EndpointForge stops with Could not check if the
        file changes while being read or if the selected tail exceeds 8,388,608 decoded
        characters. The result says only whether the text was found; matching lines and
        other file contents are not included.
 
    WindowsEvent
        LogName and EventIds are required. EventIds can be one whole number from 0 through
        65,535 or a list of up to 64 unique IDs. ProviderName can narrow the event source.
        LookbackMinutes defaults to 60 and accepts up to 10,080, which is seven days.
        MinimumCount defaults to 1 and accepts up to 1,000. Use event IDs documented for
        the selected log and source. Protected logs can require Run as administrator.
        Results contain a Boolean answer and bounded count summary, but no event messages
        or event data.
 
    TcpPort
        HostName and Port are required. TimeoutMilliseconds defaults to 3,000 and accepts
        100 through 10,000. The host must be one exact DNS name or IP address, not a URL,
        path, or wildcard. EndpointForge makes one TCP connection attempt, closes it, and
        sends no application data. The destination and network monitoring tools may still
        record the attempt. Success proves only that TCP connected, not that HTTPS,
        authentication, or the application is healthy. A checklist can contain no more
        than 32 TcpPort items.
 
    Checklist files contain paths, search text, event sources, and network destinations.
    Results and reports can show which paths and destinations were checked and whether
    they matched, even though matching log lines and event contents are omitted. Protect
    all of these files according to the organization's data rules.
 
    A missing file is a definite false answer for FileExists. A missing or unreadable text
    file is Could not check because no trustworthy text answer is available. An
    unavailable or protected event log is also Could not check. For TcpPort, a refused or
    timed-out connection is false; a host name that cannot be resolved is Could not
    check. Missing evidence is never silently treated as success.
 
COMMANDS FOR SCRIPTS
    Commands whose names begin with Get or Test return PowerShell objects and do not
    change Windows. Show commands display information for a person. New and Export
    commands write files only when requested. Invoke-EFEndpointRemediation is the command
    that can change supported Windows settings; -WhatIf turns it into a no-change preview.
 
    Useful discovery commands are:
 
        Get-Command -Module EndpointForge
        Get-Help Show-EFMenu -Full
        Get-Help Get-EFEndpointSummary -Full
        Get-Help Invoke-EFEndpointRemediation -Full
 
    Test-EFEndpointCompliance returns $true only when every applicable selected item
    matches and no checking error occurred. Add -PassThru, or use
    Get-EFComplianceReport, when a script needs details, scores, or an ExitCode.
 
SCRIPT EXIT CODES
    EndpointForge commands do not exit the hosting PowerShell process. They return an
    ExitCode property. A wrapper script should call exit only when its management system
    requires a process exit code.
 
    Combined computer check and fleet check:
 
        0 Checked items look good.
        1 A warning or partial information needs attention.
        2 A critical issue or checklist difference was found.
        3 Required information could not be collected, or a fleet target failed.
 
    Detailed compliance report:
 
        0 All applicable checked items match.
        2 One or more checked items do not match.
        3 One or more checked items could not be evaluated.
 
    Remediation report:
 
        0 Approved fixes were verified, or no change was needed.
        2 One or more selected items still do not match. A WhatIf preview normally
           leaves an item unchanged, so review PreviewCount as well as ExitCode.
        3 Checking, applying, or verifying one or more selected items failed.
 
    Operational health report:
 
        0 Healthy.
        1 Warning.
        2 Critical.
 
SECURITY BOUNDARIES
    EndpointForge intentionally does not:
 
        - restart Windows;
        - install updates or other software;
        - turn on BitLocker or start drive encryption;
        - change Secure Boot, firmware, or Trusted Platform Module settings;
        - clear a Trusted Platform Module;
        - install itself on another computer or enable PowerShell remoting;
        - query Win32_Product for installed software;
        - download and execute remote content;
        - include matching log lines or Windows event contents in checklist results;
        - bypass Group Policy, mobile-device management, Defender tamper protection,
          application-control policy, or another security product;
        - apply an automatic menu change without selection, preview, Administrator
          permission, and exact APPLY acknowledgement; or
        - promise automatic rollback.
 
    Installed software is read from Windows uninstall registry records. Unsupported or
    unavailable Windows features are reported instead of silently omitted.
 
    Follow organizational execution-policy and application-control requirements. Do not
    bypass a centrally managed policy. Reinstalling this module does not override Group
    Policy.
 
TROUBLESHOOTING
    If a result says Could not check, Access denied, Requires elevation, or that a
    protected security value was not returned:
 
        1. Run Get-EFEndpointReadiness.
        2. Open PowerShell with Run as administrator when approved.
        3. Run the detailed check again:
 
           Get-EFEndpointSummary -NoProgress |
               Show-EFEndpointSummary -Detailed
 
        4. If the result remains unavailable, confirm that the Windows edition, server
           role, virtual machine, firmware mode, and hardware support the feature.
 
    If a fix reports PartiallyChanged, EndpointForge observed a changed after-value before
    a later step reported an error. Review the before and after values plus recovery
    guidance immediately; do not assume the earlier value is still active.
 
    If a fix reports VerificationFailed or does not stay changed, Group Policy, Intune,
    another management product, Defender tamper protection, or a security agent may own
    the setting. Review the receipt and use the owning system for the lasting change.
 
    If a remote computer cannot be reached, confirm its name, network path, remoting
    policy, connecting-account permission, and installed EndpointForge version. The fleet
    command will not change those prerequisites.
 
    If the module installs but does not import, inspect the discovered version and
    effective execution policy:
 
        Get-Module -ListAvailable EndpointForge |
            Select-Object Name,Version,ModuleBase
        Get-ExecutionPolicy -List
        Import-Module EndpointForge -Verbose
 
LOGGING
    File logging is disabled by default. Set-EFConfiguration can enable newline-delimited
    JSON logging for the current PowerShell process:
 
        Set-EFConfiguration `
            -LogPath '%ProgramData%\EndpointForge\endpointforge.jsonl' `
            -LogLevel Information
 
    Protect log locations with least-privilege permissions. Logs and reports are separate;
    reports are written only when Export-EFEndpointReport or a menu save action is used.
 
SEE ALSO
    Show-EFMenu
    Get-EFEndpointReadiness
    Get-EFEndpointSummary
    Show-EFEndpointSummary
    Compare-EFEndpointSummary
    Get-EFFleetSummary
    Get-EFEndpointInventory
    Get-EFEndpointHealth
    Get-EFInstalledSoftware
    Get-EFPendingReboot
    Get-EFBaseline
    New-EFBaseline
    Test-EFBaseline
    Test-EFEndpointCompliance
    Get-EFComplianceReport
    Get-EFRemediationPlan
    Invoke-EFEndpointRemediation
    Export-EFEndpointReport
    Get-EFConfiguration
    Set-EFConfiguration